The vulnerability in Decidim involves insufficient binding of JWT-backed API authentication to the organization context. A JWT issued for an account in Organization 1 can be used to authenticate API requests against Organization 2's API, allowing access to admin-only GraphQL fields such as participantDetails and mutation paths like proposal.answer. This trust boundary violation enables an attacker with a valid JWT from one organization to read sensitive data from another organization. The problem affects API user authentication similarly. The root cause is that the current host selects the organization context but the JWT authentication does not verify that the token belongs to that organization. This vulnerability is tracked as CVE-2026-45414 and is classified under CWE-287 (Improper Authentication).

An attacker with a JWT issued for one organization can replay that token against another organization's API, gaining unauthorized read access to sensitive participant personal data and the ability to invoke certain mutation operations. This breaks access control boundaries between organizations, potentially exposing confidential information and allowing unauthorized actions within other organizations' contexts. The CVSS vector indicates network attack vector, low attack complexity, requires privileges, no user interaction, scope changed, high confidentiality impact, low integrity impact, and no availability impact.

A fix is available in Decidim versions 0.31.5 and later, as indicated by the referenced pull requests (https://github.com/decidim/decidim/pull/16673 and https://github.com/decidim/decidim/pull/16756). Users should upgrade to version 0.31.5 or later to remediate this issue. As a workaround, disabling JWT credentials via the system panel (/system) can prevent exploitation until the patch is applied.